The Zombify WordPress plugin allows uploads of files without validating the file type, enabling an attacker to place a web shell onto the web server. Once the shell is uploaded, the attacker can execute arbitrary commands on the server, resulting in full control over the affected host. This weakness is a classic example of an arbitrary file upload flaw that leads to remote code execution.

WordPress sites that use the Zombify plugin version 1.7.7 or earlier are affected. The vulnerability applies to all releases of Zombify up to and including 1.7.7. Sites running the plugin on any WordPress installation should verify their version.

The CVSS score of 10 signals a critical severity. While the EPSS score is not available, the lack of KEV listing suggests that zero‑day exploitation is not yet widely observed, but the nature of the vulnerability makes it easy to exploit for anyone with access to the upload interface. An attacker can exploit this flaw by sending a malicious file through the plugin upload form, leading to execution of arbitrary code on the server.